Analysis
-
max time kernel
123s -
max time network
132s -
platform
android_x64 -
resource
android-x64-arm64-20240514-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system -
submitted
17-05-2024 04:51
Behavioral task
behavioral1
Sample
4e7d171fcdcc00e1882872750b1f8fe6_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
4e7d171fcdcc00e1882872750b1f8fe6_JaffaCakes118.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral3
Sample
4e7d171fcdcc00e1882872750b1f8fe6_JaffaCakes118.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
4e7d171fcdcc00e1882872750b1f8fe6_JaffaCakes118.apk
-
Size
5.8MB
-
MD5
4e7d171fcdcc00e1882872750b1f8fe6
-
SHA1
e71bc1f849bd0afb0b36a3ee3574577cedb90cdb
-
SHA256
8386715c5fc28c0c5de37fbde8004c29ad1022b15141107633b2b48799fa0df7
-
SHA512
43be43293f73d18ae861109e11c7afbc8759819ca01431ac5b3720da52db320b661acb87dfa666ac490c907e0fe383e87911af9bef9b9979eeb8ce6042c503ff
-
SSDEEP
98304:M0XCcDlfLwJ55mHgLljLWH6yE6eQTsddYU46uR3M13PxuqUsRt/OI5w5tPP:9XCcDljwfJLWH68pKcRhqUGUUw5dP
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
Processes:
parseh.logo.twoioc Process /system/app/Superuser.apk parseh.logo.two /sbin/su parseh.logo.two /system/bin/su parseh.logo.two -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Requests cell location 2 TTPs 2 IoCs
Uses Android APIs to to get current cell location.
Processes:
parseh.logo.twodescription ioc Process Framework service call com.android.internal.telephony.ITelephony.getCellLocation parseh.logo.two Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo parseh.logo.two -
Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs
Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
Processes:
parseh.logo.twodescription ioc Process Framework service call android.content.pm.IPackageManager.canRequestPackageInstalls parseh.logo.two -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
parseh.logo.twodescription ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo parseh.logo.two -
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
Processes:
parseh.logo.twodescription ioc Process Framework service call android.net.wifi.IWifiManager.getScanResults parseh.logo.two -
Acquires the wake lock 1 IoCs
Processes:
parseh.logo.twodescription ioc Process Framework service call android.os.IPowerManager.acquireWakeLock parseh.logo.two -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
parseh.logo.twodescription ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo parseh.logo.two -
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes:
parseh.logo.twodescription ioc Process Framework service call android.app.job.IJobScheduler.schedule parseh.logo.two
Processes
-
parseh.logo.two1⤵
- Checks if the Android device is rooted.
- Requests cell location
- Checks the application is allowed to request package installs through the package installer
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Acquires the wake lock
- Checks if the internet connection is available
- Schedules tasks to execute at a specified time
PID:4489
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Execution Guardrails
1Geofencing
1Subvert Trust Controls
1Code Signing Policy Modification
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5776dacdfb78ddbd4037b7f51e0a60b8d
SHA1bc790247307ff232cc32c65e80c65d72756d3f70
SHA256b174ccb9077887fe020e09a0cb4247f8f42788fd5d56ec169138c93d57b4eb72
SHA512d2f9b7621a2be4532ed996fa4ed05e8a19b3c1932febfd552a059342a9d824b2cd373328b7432801c7dadae632ed0b71bca81d9a8ca0ed851b55654ab9fd0fc1
-
Filesize
8KB
MD57e885eb9d1995f4363571e548d9c653c
SHA1b8efbe7749d037626c812917ce392d74c0c78266
SHA2560cb750a9e953e831940b124f5dc7cdb9a31fe3b28e301ce91e0b7185ae1674b6
SHA512ff96fb3f8cc968db9799bc9751724439eb38066598665f80cf98e2617ca74d67118602d3dd5850c6f8a5789a0951f2c01cd7eb5bac2a24552e01b17806db8b5b
-
Filesize
8KB
MD57d59e294814107014da6c42400536af5
SHA138460bc66e3af527075fe731d303c6ca2803ca21
SHA2562b5724ec1e9681a1f39ef33f337d601b6809f66a0ddee74667397cd5495af706
SHA512d7d59e93d6814315d37bb0155cf8f6e60214df97084cd1bbd335f3e7d575d04f597ec896b7ca4549737ac598309fdee234a0cd500bbb584230489155f4f076b7
-
Filesize
8KB
MD58594740867a7eaf6abca6e8a04f6d39d
SHA142a0e5bf0ae85486435ee06e5aa72a63ac7748d4
SHA2560d8b33abc020b72d8b9d86958be2fdf83b8fe1cbd37c535057bb6986fe21eecb
SHA512f52c34904646b98486448c3e0f0f190762cd0f7362e7eb63af530ae757a5891df93d513779926aa75760bb9f2d3bb31f5bf22fd5ce6f6ead7d8a7c7fa4166e49
-
Filesize
8KB
MD50978344f2d07d3fefb16ba9880196cf8
SHA16eca81e72ccc9afd98fddf1ca5768cae1f85f76c
SHA25620ed2ec1218b6e8f36107a13f0e1c2a8ba9f575806f528fef0b8786b48352f3d
SHA5126dac16fb41e8ca553b2e4061296177a68ddfb50232c8dc510fb8ef5ff74870a05d71ed25ba0d5d07f6c160ca08715bf59a8e00567753d1203625c2f009b7cf12
-
Filesize
24KB
MD578b724b4897855e95acd16cc4b1f3a0d
SHA1ff625ab6d6ca1b853053b29e3813e0ecbacdebf0
SHA256917863e0f46eda541998aca54c001242885314b557b4cc4229072a5dc9b66d6e
SHA512bdf8d6d2be67287c4c264f6726d12015ec72a4b85361184e9392ca1d42a080635f27368e97bd32345f0505d10884db90029e6ef14ca7d71a4883aa47aee3c7c6
-
Filesize
512B
MD5c2b9d975beb9fb4796ce1ffd1ec409d2
SHA19f0def66e422df87a072c5cb7620581a1a77bc1a
SHA256d663471902b1a75c1f2c82a383cdc0d2d0ac89bdff15ab7fa0727055265551c5
SHA512e13a2a7735224ebcc04a61cb6ada540eff2ed8fafbb93fe6106a5a425bea1e26f2f5329ee78ceef54112ec85903a0f1034e27830c8b55cfb57cd9140edead187
-
Filesize
16KB
MD5b93d349780a9bfbb3b0b12304eb99806
SHA122a735174bcec10f93b51f406266c12048abcb42
SHA256b879f905e4d7dc0f040e080c8c294d43a9003c4a4d20496a628372d6e5042d8d
SHA51230be0cc76dd537458601fedd1bf2d50edf022428fe60395b3cf9ca672a884682c917a99e728dc5c648d4f62af41f3069151704217731f4f97387d460c0f49de9
-
Filesize
16KB
MD58554cf5adedb682298d5f3d2411cb6dc
SHA1ebf6aff15e943f3fd20b45bae710b4b8c782eae2
SHA2567f8df68a4150b9b7bc91cc5a1243a134cde6027973501b117f7e52da0186373a
SHA512ea90005ed9e485f189d2053ef277e5bf4fc4e87be4bcc099816fbb647d413e7662801706d24fe44fbb1bc6ed2f4f19272363a8de3f65e7599d8fcb3df534241b
-
Filesize
16KB
MD582ee0db32581286180af3ce61d5e9523
SHA1fc2bb9f1295372648f4c2c4606335b9755a60229
SHA2560ee5b73852985a92c0694217c86ee0989a62987a5f08b64bea4495ad8bc0b427
SHA51242b981e2dcacf04cb62805fc0ce87c4752d930869f106be6d1ed6ada600b0157841682bbfba8932bb3a816c23debc7f73baff4b7cc2e80b1608e8a8613acdc46
-
Filesize
16KB
MD58188a223c968b77eb4ff1474d0ac58cc
SHA1a0119bdf99cbbef380a2089b9abd18d36baa1380
SHA2568630072f33d7557efdd47d1561ca01c807f3d95c842e77e8a4548ed4e7026c40
SHA512a3c2238062dcedb9a696f92ef7768067c6febee5136417106798c18d79fb0310b8052a1a220a0e3d06578b5553b7b0c151c29b49336cca50beda04043e55d22a
-
Filesize
16KB
MD547080e3bfcf2db9b8620f2faf6c5857a
SHA16f63c1851255e0fa99567f047382074b086d38bc
SHA256dc4f8a73f49d2a6b41ff425fd08b85c1eba5280c438a1a1ff9832e91dfa56cbb
SHA512e757043d82798926a5ddd716457accf6616894ad1ad79ec832293a1f662910b663239f899bf05a5c8d90fed5bcb093c5529e5bc842fe9003c1d5902f9ed84473
-
Filesize
16KB
MD5209e235aec1a87462824ac3d67de26b7
SHA15c87982b8028d3a4f4291abf83a64ef114bd5038
SHA25633e4ed5e2eefe2cbea1d4c9c30cf7ea538492ea96a46886caf8dd90d700efddb
SHA5121e03393665111dc4786d76151ff0506493110e4fa724cf17f49e9ba5fdfb3157711b0c0bd14f83af8cd1ee9cf7a5f8b06c5cd7fedb62b539a9a3fcc3e9707393
-
Filesize
8KB
MD502724c2e29e68db4f5414ad398464819
SHA184079864ea5ed3e69e38384058787693af2f49f2
SHA25640f9b67bb31729435a40d4ed2fc23237715fb2414595a91f80d3eb93d1c94004
SHA5125537930ae39864d446f58abf651ea914595981f4beb35e1bd3de6a801646bec2c9708953d058d22ca71f8d9ad7ba981e066e72befb7ae910f897d1fc7adbcccb
-
Filesize
8KB
MD5894dbd5902365581bac1124056956050
SHA1eb001a54d6cd8a9dc7ce2e1618d275b6b6452197
SHA25611b1f4a3d09c32987487e98504b0cf7e9211e18381e6c555e6d58e656f9d1fe3
SHA512575030726bdcc235ba52f7dea9b1ed0216e716447b2640a2be6b5c1aec96747c4f5623538fc507b9c0657a693a610bfff515ff19f4e649c6f9f0d8acbc56d092
-
Filesize
512B
MD5d7bd644d0ff702a6a9123826d1915e62
SHA1d4e8411a06bbfc799dab9268a1d601fa0740fcb6
SHA256032af224aa5e78e7c8c25870907fe7e975ea2a4b72aff9be999e303f2e15d57e
SHA512523799ec004b309e596c8b0c3e5dd834bb8b501f60b4702025b79141684c10002443943b601b36a8ddae03d2a2f36ab03bef03e4370e6e7c470b230eed0d2887
-
Filesize
8KB
MD5002cc3b19d2bff46ccb57b57f5f40e13
SHA1584cb2b30fe1fcaa279d85f1400720d31a27c7e2
SHA2567eb77a3e93dfb3993ca587ca011c412c89b98a5ba9de0f4cf6c3b5853fd63b84
SHA51288b4a37647c7dd3b127f6aba98761390a0543d9c2ae0786543748baacda3988484dac2099497d0759e54e8bcd8c47caeb675b7e3d2348dff6b72ac2931f73734
-
Filesize
8KB
MD52afe9943b53f307221fca42c904833da
SHA1f98fe296fe4ae78568e971c6bbdc239a77ad90f2
SHA256b3540be48a75be66cc2a5e7aebe636b7d5b650733e3695e43264b8f0e1e2a56b
SHA512aed830d1fc77bcdccf8a419a15ec86c5ddeb4989fe57a210abccfd6be44da194781cb8d1a3f0f7da69fb2b4d0afdfaacc0d1e132f0afd5c61b1204ca475a3870
-
Filesize
8KB
MD59708fd4d51d6e69b3c70bc41f9f5bee5
SHA1a076afe3f61944b4cbb203c95ffbecaff4173875
SHA2564ae6d788807a83543197541468972ac42552d131509999e9f62f90c03c9ab4c2
SHA512f4be0faaf90f2b700575c11197879fa6d031f98891887754589d48b4fc17728ae415f0b82d116967f23dbec5934595840e58ebd87648be9dc9abe3fc26ba9a54
-
Filesize
36KB
MD5f73e6bbf9b484f89037480ed1ffdf3d0
SHA16e452a8b856956a331299bee8bdda4e3be3ed6b1
SHA2564beb9ca21b7e7dccf054ffdb3d02169caff8cd3a01f58c763c8f07481b3ef672
SHA512b85619c3571d6ef4e1d0df8477193ab8190d547e82e482b82ca754504d754e32110c81e82d0a139ea524961ad08e5a61bd4c0afd1de5e8752fd160208b24c1a6
-
Filesize
28KB
MD5e250400dd81d6c1eab2381f9e611b4b2
SHA1d50deca82c2b38227254ad5662c5a59c7169dd86
SHA256ec9e9f51d149d600131dfc1262eb25c85ca4dccda54da194bc222678741d48b0
SHA5127d5768018ca96ed255d9880f851972ade6dc4b789208df3bb9880c36b935017e885c8ced49d944d79944e3a8264c9e72103e9d337f50441716d45230680cb590
-
Filesize
28KB
MD5453210ce1af5ac6418962ae9b76443c3
SHA191d562d2fc2a242f5cbc273c70a05f92059da4be
SHA256488c39fad62924cbd03c78a4c8d2f76fc3de8787e4ef7d6d0adfc340079947da
SHA512847c83461606899af930c68ecf0dc803e7087e7969b316f1147db359f691d3074579dd4fb8d9a5f9a7ac9dea89b4a95f0263d6ebcbdd7e29db4e9285ccab7599
-
Filesize
512B
MD553314b69c92d87666ae5804de7038eec
SHA16943cc1bfa1220dd69fc80524e80506970d4e35f
SHA256bab45cadd0195eaf748e42ab2fec1b2ffd371e09a4bd5540a15a8826c69b5b8d
SHA51241e168bc4c677f339276db252ee7caab08141f7e340f75d81745932b1dce6cb5bf18964f1808ff4dace60db53e53f520f199d943645a707d2f59de04a6a7d08e
-
Filesize
8KB
MD515c5f7fcd96de6f5a1d80a2b4ab6743c
SHA1f7845d5670d6fb227f07821511108812a7bc28db
SHA256d6b36735ec49029d36df7a12024dd82cd77e79dd120a1765f493d990c4a08bf1
SHA512fa8a78e6fce902b741d3b143002941db01ea0c51ed2112e8e6333b6e81e6e704dfec05e88b4b432ab0ed535e2b61fd8b282e47522e78b0ae694095f0b6d76d7a
-
Filesize
8KB
MD5d232f127d381ddc590f5e12a9ff971e6
SHA1e383e7a3face1301390aa4965a04cac823851f29
SHA2564e87e08e7bdb01a48323cf9c40db9778b40cf278b5f2e40f466de3c82cb99b8c
SHA512e9bdb29c6730c750271512f355cf8b8e1d2fcf86a7dd8258eeefca694d1a5b9893c838123eea49604f8b635c3755885a2574a373de848fc7aa7044e4b717b7da
-
Filesize
12KB
MD598cfb5c584a072920f50904135d8396b
SHA182d8857fb48f04ffeca67423f91afdcb81b05e66
SHA256d3bc0973d8eb399ad6c894325b7db10458d9c28f6a5cc883794fa396573fa552
SHA5122dc366f4fb315ca2142ec67c63594a6e64f25810b6857ab36b124bd1ced93bf1f52adb696bc3d90c169b62e749cc555820b483a682bf3d195a33801d60d5f925
-
Filesize
12KB
MD5d6740a149bf3d3c1c0da0d4f8a08137d
SHA102b9dd89d99f16cfd83223bb2119643af22a1ea2
SHA2568086f574b97a502ee8429874d70963f7336611a84d12b41c94d3b791b94cf4a8
SHA51202468fafda51de96d6f65b2de7bbcfc6eabe8549726d7a0d3463ffafef5a493a6eb504bc8255754f8de4b534d804ea9ca028662a06c0602242f68c55bfda7257
-
Filesize
44KB
MD50854c610436dadcbb743b96cabb3dbc9
SHA141b9835568cdf26a7e3f4df73cb8b08b50022982
SHA2560708d030ed80a593f272a70ceb6a2dbe8cb1fbfba553bc1372d5ab187bf06845
SHA512e1b878c482375f34fad6dc9021e8edba84ece7103137c39dacd144b8a9ef92713215f23236067aaa7dabb7f8103651c138023ca0dbc3cbd993e6a9b0b99b0801
-
Filesize
512B
MD5d78eeaecb93015682a51f348176aa0b5
SHA1424ab21ee6870cdaa5c4fe00b80540d8f630adb7
SHA256f8a9650dc7101cafe8f1190fe13f8ad57b302a124b26bc29136e2ee0eb5a1f84
SHA5126436961813187b6ca2303a028c6dcfd0f7d31f5634a561d300cdc1e178e6ad2f8d4d9f1b5f699b2b654dbf74470266e4172c5e9b84577054c90bd84aa26329cb
-
Filesize
8KB
MD5cf00dcac04d8b60609d8212dc6c817a1
SHA1dc8afa442043bc9d03d85b28fe82ced525382adf
SHA25609b998193dbdb6265cc872358ebaf5b58caaa0f2d2432fb045eeb0f106c037bb
SHA512c3d8468db8086bc3a260c427cbe02e25874078dc1d012e61ae5bac953c8cb9a1a3758392fc7c0f3df0ae58ed0a54a24c6e837a7b0642d14205d9bb18a8a1f912
-
Filesize
8KB
MD572098fbc7aaba46592f8203d818e3eaf
SHA17990a871cc23af5e3b8e47eba3b9157e8c9ff4eb
SHA25691c89bbec1cbefc187d97f6bc11dc74cbbe7496442549e1dff3f189a7d4c1c6a
SHA51247a19e5b329e53b4a7aa33daed4415a4a5c1d3bc811f81a222a9a79b7b0c70dddebfa0e71394d771d3203b903190d5c67937c2d9d56c9a7f44b3a27afd80cc2c
-
Filesize
12KB
MD54e9121b57a511edd54aefb1cf6416613
SHA170a6efcbfb210f4121e9f3dd4c0057c2ba324a24
SHA2562f5f28a4c1fb8236d2bfaf182523b0c0332275dae521b69832acba5915b7acc2
SHA51291c5f8fafdb85b4bd39adc3378e0d6d8994e3bf0c53c5301a23a243c4ba369a1edbd0f0336542ec920d7bd2af9457a5007a3299520aa1a1b77a1fb2a013652fd
-
Filesize
3KB
MD542ed81df7776b8b0ce4272a0928a2565
SHA151d7d6847c17547d17f5e658341022f0c1566ca8
SHA25625d3f3d41f695978a1920935a09c2839ea1cc221191aab12dbb03560156a72a4
SHA51276a9bf954af4cf14e909ead307ff46bd978b01bc25aa7b30a565cf7128b55166c8381e5cabf05705d271dbf8301e2f6834cf4dc3285dc2d17a05ba76da3ea33c
-
Filesize
58B
MD50d210bfb2a0e1f1b4c082a6a0f79de07
SHA1bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA256988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
SHA512536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1